Protect from forgery with null session